From 6e2416dc56247eac1814b18cc024774f740ccfae Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Thu, 30 Oct 2025 17:00:57 +0200
Subject: [PATCH 1/3] fix kanban menu with star

---
 client/res/templates/record/kanban-item.tpl |  2 +-
 client/src/ui/app-init.js                   | 16 +++++++++++-----
 frontend/less/espo/elements/dropdown.less   |  4 ++--
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/client/res/templates/record/kanban-item.tpl b/client/res/templates/record/kanban-item.tpl
index 786689bd0a..c6771e2a4b 100644
--- a/client/res/templates/record/kanban-item.tpl
+++ b/client/res/templates/record/kanban-item.tpl
@@ -4,7 +4,7 @@
         <div>
             {{#if isFirst}}
             {{#unless rowActionsDisabled}}
-            <div class="pull-right item-menu-container fix-overflow">{{{../itemMenu}}}</div>
+            <div class="pull-right item-menu-container fix-position">{{{../itemMenu}}}</div>
             {{/unless}}
             {{/if}}
             <div class="form-group">
diff --git a/client/src/ui/app-init.js b/client/src/ui/app-init.js
index a2ddcc882d..37a4c36bef 100644
--- a/client/src/ui/app-init.js
+++ b/client/src/ui/app-init.js
@@ -112,8 +112,14 @@ function uiAppInit() {
 
         const $dashletBody = $(target).closest('.dashlet-body');
 
-        if ($dashletBody.length) {
-            const $body = $dashletBody;
+        const fixPosition = e.target.parentElement.classList.contains('fix-position');
+
+        if ($dashletBody.length || fixPosition) {
+            let $body = $dashletBody;
+
+            if (fixPosition) {
+                $body = $(window);
+            }
 
             $(target).removeClass('dropup');
 
@@ -152,10 +158,10 @@ function uiAppInit() {
                 right: 'auto',
             });
 
-            return;
+            //return;
         }
 
-        if (e.target.parentElement.classList.contains('fix-overflow')) {
+        /*if (e.target.parentElement.classList.contains('fix-overflow')) {
             $(target).removeClass('dropup');
 
             const isRight = e.target.classList.contains('pull-right');
@@ -187,7 +193,7 @@ function uiAppInit() {
                 left: left,
                 right: 'auto',
             });
-        }
+        }*/
     });
 }
 
diff --git a/frontend/less/espo/elements/dropdown.less b/frontend/less/espo/elements/dropdown.less
index 2b71630930..ea8e183178 100644
--- a/frontend/less/espo/elements/dropdown.less
+++ b/frontend/less/espo/elements/dropdown.less
@@ -204,11 +204,11 @@ ul.dropdown-menu {
     margin-right: var(--2px);
 }
 
-.fix-overflow {
+/*.fix-position {
     .btn-group {
         position: unset;
     }
-}
+}*/
 
 .dropdown-menu {
     .quick-search-list-item {

From 876b74aefcba2f40ca70934c7dc8a1a130f5ebc1 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Sat, 1 Nov 2025 15:53:04 +0200
Subject: [PATCH 2/3] loader error callback fix

---
 client/src/loader.js | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/client/src/loader.js b/client/src/loader.js
index bab05c453d..c2b43ee8f2 100644
--- a/client/src/loader.js
+++ b/client/src/loader.js
@@ -763,7 +763,7 @@
                     }
 
                     console.warn(`Could not obtain ${id}.`);
-                });
+                }, errorCallback);
 
                 return;
             }
@@ -792,9 +792,10 @@
          * @private
          * @param {string} url
          * @param {function} callback
+         * @param {function|null} [errorCallback]
          * @return {Promise}
          */
-        _addScript(url, callback) {
+        _addScript(url, callback, errorCallback = null) {
             const script = document.createElement('script');
 
             script.src = url;
@@ -802,6 +803,10 @@
 
             script.addEventListener('error', e => {
                 console.error(`Could not load script '${url}'.`, e);
+
+                if (errorCallback) {
+                    errorCallback();
+                }
             });
 
             document.head.appendChild(script);

From c1c4a2bedcf5252e3b96656e15707b769dbec819 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Sat, 1 Nov 2025 16:04:19 +0200
Subject: [PATCH 3/3] controller name check

---
 client/src/app.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/client/src/app.js b/client/src/app.js
index 81954dae96..e88ed9f287 100644
--- a/client/src/app.js
+++ b/client/src/app.js
@@ -691,6 +691,14 @@ class App {
             if (!className) {
                 const module = this.metadata.get(`scopes.${name}.module`);
 
+                if (!/^[A-Za-z0-9]+$/.test(name)) {
+                    console.error(`Bad controller name ${name}.`);
+
+                    this.baseController.error404();
+
+                    return;
+                }
+
                 className = Utils.composeClassName(module, name, 'controllers');
             }